NIST PIV and digital identity IR 7863
| Ref | Title | Text | |
|---|---|---|---|
| 1 | Introduction | Federal Information Processing Standard (FIPS) 201 defines the Personal Identity Verification (PIV) Card and supporting process requirements. A private cryptographic key, the digital signature key (DSK), is specified for digitally signing m | |
| 2 | Background | The digital signature key (DSK) is intended to sign data, such as electronic forms, documents or electronic mail. Operations using the DSK can be performed after the PIV Card has been activated. To protect the DSK against misuse after activ | |
| 3 | Architectures | There are two basic configurations for a PIV compliant system that leverages the DSK: (1) A computing system can be designed so that the PIN is never exposed to the operating system, middleware, or applications. The components of this syste | |
| 4 | Minimum Security Objectives & Controls | This section specifies minimum security controls and objectives for system implementations that leverage the DSK to ensure that each presentation of the PIN represents an explicit user action. Section 4.1 describes functional requirements f | |
| 4.1 in 4 |
Per-Transaction PIN Entry | Entering the PIN each time is the most direct and strongest mechanism to achieve explicit user action for the PIN ALWAYS access condition of the DSK. This can be achieved by any of the following methods: (1) PIN entry is performed exclusive | |
| 4.2 in 4 |
Explicit User Action with PIN Caching | If the PIN is cached by any component of the system, it is the system’s responsibility to ensure an explicit user action occurs before the PIN is presented to the PIV Card. Examples of affirmative action could include clicking “OK” in a pop |
6 of 6.